Nix: Improve build reproducibility and fix OCaml library loading

[remix7531]

This PR improves the Nix flake for F* with proper OCaml library path handling, better formatting, and an isolated CI testing target.

Changes

Commit 1: Add CAML_LD_LIBRARY_PATH and fix diff sh call

• Automatically discover and set CAML_LD_LIBRARY_PATH for OCaml shared libraries in devShell
• Add num to propagatedBuildInputs (required for runtime library loading)
• Fix diff.sh path in test.mk

Commit 2: Sort dependency lists and format

• Alphabetically sort dependency lists for maintainability
• Format code consistently

Commit 3: Add isolated CI build target and fix sandbox issues

• New fstar-ci-nofsharp package for reproducible testing in pure Nix sandbox
• Add python3, which, util-linux to build dependencies (required by tests)
• Set DUNE_CACHE=disabled to avoid permission errors in sandboxed builds
• Export CAML_LD_LIBRARY_PATH with auto-discovered OCaml shared library paths
• Excludes F# support (requires EOL .NET 6, incompatible with nixpkgs .NET 8)
• Runs: make 2, test, stage3-diff, test-2-bare, stage2-unit-tests

Testing

Test the isolated CI build with:

nix build .#fstar-ci-nofsharp --option sandbox true --option pure-eval true -L

[remix7531]

Working on PR 4080, I encountered some issues with the Nix environment:

1. The flake was not completely sandboxed/independent from the host system
2. Shared libraries from the num package were not correctly exposed via CAML_LD_LIBRARY_PATH

This draft PR addresses these issues and adds a fstar-ci-nofsharp target for isolated CI testing in a pure sandbox.

@gebner @Nadrieril What do you think of the current approach? A few questions:

• Should we use checkPhase instead of a separate CI package target?
• Should we bump the F# dependency to .NET 8 (requires updating global.json)? The current .NET 6 requirement is EOL.

I'd like to hear your thoughts before restructuring the commits and finalizing this PR.

[remix7531]

I will undo the formatting.

[Nadrieril]

Overall looks pretty good to me! I don't mind the formatting commit, I too have autoformat enabled ^^ Can't comment on the F# version, I know nothing about that; the nix looks good if we can avoid the IFD.

[Nadrieril]

Much better, LGTM now! I don't have merge rights fyi

[remix7531]

@gebner Requesting additional review on this PR. I do not have permission to request reviewers directly. Thanks!